Struct PkiEnvironment 

pub struct PkiEnvironment { /* private fields */ }

The PKI environment which can be initialized independently from a CoreCrypto session.

Implementations

impl PkiEnvironment

pub async fn fetch_crls( &self, uris: impl Iterator<Item = &str>, ) -> Result<HashMap<String, Vec<u8>>>

Fetch certificate revocation lists from the given URIs, return a map from the URLs to a DER-encoded certificate list.

pub async fn save_crl(&self, crl_dp: &str, crl_der: &[u8]) -> Result<()>

Validate the CRL (trust anchors must be configured prior to this) and save it to the database.

impl PkiEnvironment

pub async fn new( hooks: Arc<dyn PkiEnvironmentHooks>, database: Database, ) -> Result<PkiEnvironment>

Create a new PKI Environment

pub async fn get_trust_anchors(&self) -> Vec<Certificate>

Return certificates that are used as trust anchors.

pub fn hooks(&self) -> Arc<dyn PkiEnvironmentHooks>

Get the hooks.

pub fn database(&self) -> &Database

Get the database.

pub async fn add_trust_anchor(&self, cert: Certificate) -> Result<()>

Adds the certificate as a trust anchor to the PKI environment.

The certificate is saved to the database, and included in the PKI environment for future validation.

Caution

Adding a trust anchor will replace any existing trust anchor. This limitation will be relaxed in the future.

pub async fn add_intermediate_cert(&self, cert: Certificate) -> Result<()>

Adds the certificate to the PKI environment.

The certificate is saved to the database, and included in the PKI environment for future validation.

CRL (Certificate Revocation List) distribution points are extracted from the certificate and an attempt is made to fetch a CRL from each one.

pub async fn validate_cert( &self, cert: &Certificate, ) -> RustyX509CheckResult<()>

Validate an end-entity X509 certificate.

Performs validation of the provided certificate in the context defined by the set of trust anchors and intermediate certificates contained in this PKI environment. Revocation check is performed and time of interest is set to the time of the call.

pub async fn validate_credential<'a>( &'a self, credential: CredentialRef<'a>, ) -> CredentialAuthenticationStatus

Validate an X509 credential.

Panics

Panics if the provided credential is not of type X509.

Trait Implementations

impl Debug for PkiEnvironment

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.